Hive

Hive was a ransomware-as-a-service (RaaS) operation first observed in June 2021 and dismantled in January 2023 through a joint law-enforcement action. It operated an affiliate model in which core operators provided ransomware tooling, leak-site infrastructure, and negotiation support, while affiliates conducted intrusions and shared ransom proceeds. Hive is widely characterized as a double-extortion actor: affiliates stole data prior to encryption and threatened publication on the group’s leak site if victims refused to pay. The operation was notable for its high tempo, broad victimology, and repeated targeting of healthcare organizations despite the potential for operational harm. Hive targeted enterprises across multiple sectors, including healthcare, manufacturing, legal, energy, finance, technology, and government-related organizations. Victims were observed in North America, Europe, and Latin America, with especially frequent reporting involving the United States and Canada. Healthcare intrusions were a defining feature of the group’s activity, including disruptive attacks on hospitals and health-plan providers. Initial access and intrusion tradecraft associated with Hive included phishing with malicious attachments, exploitation of vulnerable Microsoft Exchange servers via ProxyShell, abuse of exposed RDP, use of compromised VPN credentials, and socially engineered access paths linked to callback-phishing ecosystems. Post-compromise activity included deployment of Cobalt Strike, credential theft with tools such as Mimikatz and LSASS dumping, Active Directory reconnaissance with utilities such as ADFind, SharpView, BloodHound, and ADRecon, password spraying, lateral movement via RDP, WMI, scheduled tasks, and Group Policy, and data exfiltration prior to encryption. Hive operators and affiliates also showed strong defense-evasion behavior, including disabling security tools, deleting shadow copies, clearing logs, terminating backup and database processes, and using obfuscated loaders to stage payloads. Hive malware was initially associated with Windows payloads written in Go and later expanded to Linux, FreeBSD, and VMware ESXi-targeting variants. Reporting also indicates the developers later ported code to Rust. The malware supported command-line execution and was used in human-operated intrusions rather than indiscriminate mass deployment. Hive affiliates were observed using publicly available penetration-testing frameworks and custom loaders, including an obfuscation method known as IPfuscation that encoded shellcode as address-like strings before reconstructing and executing a Cobalt Strike stager at runtime. The group maintained leak-site infrastructure and centralized victim negotiations, and affiliates could generate ransomware builds rapidly through the operator-managed platform. Some reporting indicated that Hive’s decryptor was unreliable and in some cases damaged virtualized systems. In January 2023, Hive’s infrastructure was seized and the operation ceased. Subsequent reporting noted code overlap and possible asset transfer involving Hunters International, although Hive and Hunters International should be treated as distinct entities.